More Resources

WUS Expands Patching Portfolio

With its public beta under way, WUS shows off more of its fine-tuned features.

By Don Jones

March 01, 2005

I've been a big fan of Windows Update Services (WUS) all along,
and Beta 2 confirms my belief that Microsoft is doing the right
thing when it comes to patch management. The last time I checked
it out, it was in the early beta stage, yet it already showed a
lot of promise. Now it's feature-complete, more polished and refined.
A public beta is underway to ensure that WUS is stable and as bug-free
as possible.

Remember that WUS is simply the new name for Software Update Services (SUS). WUS will update much more than just Windows, however. It will include updates for Office, Exchange, SQL Server, ISA Server and eventually the entire Windows Server System lineup. This broad support comes from version 5 of the Windows Update Web site—which has been renamed as simply Microsoft Update (the new URL is http://update.microsoft.com).

Buffing the Edges
There's nothing really new in WUS Beta 2, but Microsoft has significantly
fine-tuned and solidified several aspects of the product. For example,
WUS will now offer delta updates. Imagine that update one comes
out and modifies three files. Update two comes out and touches those
same three files, but only one of them is different from update
one. If you've already installed update one, you can get just the
difference, or delta, between one and two, which results in a shorter
download. This places a bit more overhead on the WUS server, which
has to download not only update two, but also the delta. But it
will ultimately save a lot of effort for clients, especially those
operating over a WAN link.

The major features of WUS haven' t changed, although they work more smoothly in some cases. For example, WUS can scan your client computers and prepare a report of missing updates. Companies that have to deal with compliance issues will truly appreciate this level of reporting depth. WUS also has a restart aggregation feature that bundles updates that require a restart into
a single application. This reduces the number of times you have to restart clients and servers. Microsoft' s intent with this feature is to reduce the
likelihood of restart-required updates being installed without performing the restart. This can leave Windows in an odd, semi-stable state.

Another cool thing WUS lets you do
is target updates to specific computers, which helps you do things like create a test group. You can base your targeting on groups that you define on the WUS server itself. In an Active Directory
environment, you can also target
organizational units (OUs).

Hard Numbers
Until now, there haven't been any hard numbers available regarding
WUS' scalability, mainly because it was still so early in its development
cycle. Now we know more.

First of all, the system requirements for WUS are positively paltry.
It doesn't require a domain controller, or even an AD domain. It
will run on pretty much anything that runs Windows 2000 or Windows
2003. Nearly everyone will have some little server that can do the
job. Even on a small server, WUS can support more than 15,000 clients,
so scalability is clearly not a factor.

WUS does require SQL Server as its back-end, but that doesn't
mean you need to rush out and buy a SQL Server license. It will
work just fine with the Microsoft SQL Server Desktop Engine (MSDE),
which runs on Win2000 and can support up to a 2GB database. In WUS
terms, that's about five to six years of use.

The news is even better running on Win2003, because it supports
a WinMSDE engine with no database size limit. Of course, if you
have access to a full SQL Server license and want to use it, go
right ahead. You'll be able to take advantage of SQL Reporting Services
and better administration tools.

Beta Man's
Routine Disclaimer:

The software described here is incomplete and still under development; expect it to change before its final release—and hope it changes for the better.

Security by Signature
WUS is built around a fairly robust security model. On the theory
that you don't care who receives updates, WUS doesn't attempt any
kind of client authentication. It does, however, let you distribute
updates over an encrypted channel using HTTPS.

The biggest fear in a product like WUS is that updates may be
modified or corrupted in transit. WUS combats this by only downloading
updates that have a Microsoft digital signature. Those updates are
made available to clients only if the signature matches the update,
meaning the update hasn't been altered. The updates also have to
match a checksum included in the update description. This ensures
that WUS gets the updates it's expecting.

Scripting Access
WUS is so much more than its predecessor SUS, it's hard to believe
Microsoft is still giving it away for free. (Not that I'm complaining,
mind you.) For example, WUS includes a complete application programming
interface that makes it accessible to third-party software developers
and administrators writing scripts. The client-side of WUS is exposed
through the Component Object Model (COM), an application model that
is easily accessible to scripting languages like VBScript.

The server side is exposed through Microsoft' s managed .NET
Framework. It's less scriptable for now, but easier for third-party
software developers to integrate.

The very term third-party integration may send shivers up your spine. Does that mean you can use WUS to update more than just Microsoft products?

Not exactly; you must understand that all updates pushed out through
WUS ultimately come from the Microsoft Update Web site. You're unlikely
to find Microsoft shipping updates for other people's products.
What third-party developers can do is leverage WUS technology to
create a parallel update-distribution system, provide management
tools for WUS or integrate WUS management into other products.

Wanted: Betas for Review

Beta Man is always on the lookout for quality products to review. If you know of a software product that is currently or soon to be in beta, contact Beta Man at don@scriptinganswers.com. Vendors are welcome, but please act early—the meticulous Beta Man needs plenty of lead time.

Clients, Compatibility and Coexistence
The new WUS client exists only in WinXP SP1 and Win2003 SP1. Other
clients are likely to already have the Automatic Updates client,
so the new client would be the first thing WUS pushes out to them.
The practical upshot is that you can install WUS and have it running
immediately. It will take care of updating whatever needs updating.

WUS will carry updates for nearly every version of Windows that is still supported, including Win2000, WinXP, Win2003, Small Business Server and even the 64-bit versions of Windows (both Itanium and x64). WUS will also coexist with SUS if you need it to, which lets you roll out WUS as gradually as you like.

WUS is shaping up to be a solid
addition to any enterprise. It
complements Microsoft Systems Management Server and can work in nearly any Windows environment—Win2000, Win2003, AD or non-AD, whatever you have. It' s easy to install, easy to deploy and easy to operate. Most importantly, it makes the
daunting task of patch management relatively easy, and that' s good news for everybody.